FDA Lists GE HealthCare Centricity Universal Viewer Correction Over Exposed Login Credentials

GE HealthCare is correcting three groups of its Centricity Universal Viewer imaging software because of a cybersecurity vulnerability that can expose user login credentials on local workstations, according to recall records the U.S. Food and Drug Administration posted on March 16. The HIPAA Journal reported on March 20 that the FDA has classified the action as a class 2 recall.

Centricity Universal Viewer displays medical images, including mammograms, and data from various imaging sources. The FDA's recall records, read through the agency's openFDA database, cover versions 7.0 through 7.0 SP2.0.1, versions 6.0 through 6.0 SP10.4.1, and versions 5.0 SP6 through 5.0 SP7.1. The entries, recall numbers Z-1569-2026, Z-1570-2026 and Z-1571-2026, list 1,568, 797 and 40 units respectively, distributed worldwide and across the United States.

The vulnerability

The FDA entries give the same reason for all three: "User login credentials may be exposed on the local client workstation, which could allow an unauthorized individual to potentially impact system availability and/or manipulate data." The agency lists the root cause as software design. GE HealthCare began the recall on January 30, 2026, when it sent customers an urgent medical device correction letter, according to the records.

The HIPAA Journal said the vulnerability was found by GE HealthCare during routine testing and that the company is working on a permanent fix. A class 2 recall covers situations in which use of a product may cause temporary or medically reversible adverse health consequences, or in which the probability of serious adverse health consequences is remote, the outlet noted.

"Patient safety is our top priority. There have been no reports of unauthorized access to patient data as a result of this potential issue. Direct physical access to the workstation is necessary to exploit this potential vulnerability," a GE HealthCare spokesperson told the outlet.

What GE HealthCare told customers

According to the FDA records, the company's letter says customers can keep using the software pending a correction if they ensure workstations have appropriate security controls as described in the product manuals, and implement network account authentication using Active Directory or LDAP services for user management. Sites that cannot use network account authentication are asked to contact GE HealthCare Service for temporary steps to mitigate the issue.

The letter also asks customers to inform all potential users at their facilities and return an acknowledgement form. "GE HealthCare will correct all affected products at no cost to you," the notice states, adding that a company representative will contact customers to arrange the correction.

The records list the products under FDA product code LLZ, for radiological image processing systems, with each version group tied to a separate 510(k) clearance: K182419, K150420 and K123174. The recall status was listed as open.